Objective 4: Ensure conformance with internal and external requirements
Security policy and practice should conform to the requirements of interested parties, including law, regulation, contracts and internal commitments, with independent assurance where the board needs it.
What clause 7.2.4 asks
Conformance has two halves. First, gather what must be met: law, regulation, contracts and the organization's own commitments. Second, test the practice against it. The clause adds a route to assurance that does not depend on the team grading its own work: top management may commission an independent security audit. It does not demand one every year. The register and the audit belong together, one saying what is required and the other giving an outside view of whether it is met. An audit that covers everything in a catalogue is less useful than one aimed at the requirements the board actually relies on.
Why it matters
Conformance has a long tail. A contract signed three years ago can contain a security schedule that the current team has never read. A regulation can change while the policy stays still. The clause asks for the requirements to be gathered and for the practice to be tested against them. The independent audit is not a substitute for management checking its own work. It is the extra assurance the board can ask for when the risk is high or the internal view is contested. Used well, the audit covers the requirements the board cares about rather than every control in the catalogue. Used badly, it becomes an annual ritual that proves the auditor was there.
What good looks like
Build the requirements register with four columns: the source, the obligation in plain words, the policy or control that meets it, and the evidence. Cover law, regulation, contracts and internal commitments. Mark the high-consequence items. Then design the assurance plan around those items, using independent audit where the board needs a view it can trust. Report conformance and open exceptions to the board with the date each will close. Keep the audit scope in the plan so the reader can see what was not covered.
Evidence a board or an auditor asks for
The requirements register with source, obligation, response and evidence; the assurance plan with scope and independence recorded; the audit report and the exception closure log; the board paper that states what is and is not covered.
- Record The requirements register with source, obligation, response and evidence
- Record the assurance plan with scope and independence recorded
- Record the audit report and the exception closure log
- Record the board paper that states what is and is not covered
Where it commonly fails
- Conformance asserted by the security function with no independent view
- Contractual security commitments unknown to the people who must meet them
- An audit that covers the wrong scope and gives false comfort
What to do before publication
Before the edition 3 text is published, put clause 7.2.4 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
← 7.2.3 Objective 3: Set the direction of acquisition7.2.5 Objective 5: Foster a security-positive culture →